Privacy × AI A weekly EU privacy and AI brief, with primary sources and practical context
Home Archive Add weekly reminder

The transfer clauses were in place, the assessment was not

Issue 8 · 22 October 2026 · Covers 14 to 21 October 2026 · About 8 min read
The weekly brief in video
1

Executive Summary

2

In Focus

International transfers Belgium Decision on the merits 9 October 2026

Standard contractual clauses were in place, but the Belgian authority found a transfer breach because no transfer impact assessment was ever done

On 9 October 2026 the Litigation Chamber of the Belgian Data Protection Authority (APD) decided a complaint by a candidate who had sat two oral selection sessions over Microsoft Teams, in November 2020 and April 2021. The decision is numbered 278/2026 and the case DOS-2021-00682. The two public bodies are anonymised in the decision and are not named here; Microsoft, their supplier, is named. One, called the selection body below, is responsible for the selection of state officials. The other, the organising body, chose Teams and ran the sessions.

The Litigation Chamber found the two bodies to be joint controllers under Article 26 GDPR, because their decisions on the purposes and means of the processing converged. Microsoft acts as a processor under Article 28, under a data processing agreement, and Microsoft Corporation in the United States is the importer.

The decision finds that the sessions involved at least two categories of data: client data, meaning the audio and video, and diagnostic data, meaning the user identifier and role, the event name and the IP address.

The organising body argued that, because the complainant had joined as an "Anonymous Access Participant", the identifier he chose was not retained in Microsoft's logs. The Litigation Chamber rejected the argument. The audio and video allow participants to be identified directly, and the organising body held both the event name and the candidate's name, so it had means that could reasonably be used to identify him. The Chamber added that whether or not the data are recorded does not alter their personal character, and it relied on the Court of Justice's reasoning in IAB Europe for the breadth of the notion of personal data.

The transfer findings are the substance of the decision. The two bodies, the defendants in the procedure, had annexed the 2010 standard contractual clauses to their agreement with Microsoft on 21 July 2020 and integrated the 2021 clauses on 15 September 2021, so the transfer tool was in place for nearly all of the period and had been kept current. What was missing was any assessment of whether that tool actually protected the data once they reached the United States.

The Chamber rejected three arguments for not carrying out that assessment:

  1. That the risk was insignificant. The Chamber held that Schrems II identifies an established risk of generalised surveillance by United States public authorities, which required the defendants to assess it and to implement mitigating measures.
  2. That the transfers were ephemeral, because a selection session is short. The file contained no prior analysis and no evidence showing that brevity reduced the risk sufficiently.
  3. That the defendants could rely on the protective measures Microsoft itself applies. In the Chamber's view, a controller that relies on its processor's measures without showing a prior analysis of its own has not done enough.

The defendants also invoked the derogation for important reasons of public interest in Article 49(1)(d), pointing to the circumstances of the COVID-19 pandemic. The Chamber excluded it: the derogations are interpreted restrictively, and the tools in Article 46 were available.

The operative part of the decision finds a breach of Articles 44 and 46(2)(c) GDPR for the period from 16 July 2020 to 10 July 2023. In its reasoning the Chamber also finds an infringement of Article 49, because the conditions for the derogation were not met; the operative part names only Articles 44 and 46(2)(c). The sanction is a reprimand, under Article 58(2)(b) GDPR and Article 100 §1 5° of the Belgian framework law. There is no fine.

The second limb of the operative part closes a fourth finding of the APD's Inspection Service, that no data protection impact assessment had been carried out for the use of Microsoft products. The Chamber closed it as falling outside the scope of the complaint, adding that nothing in the file showed that the organising body used those services generally.

The period found to be in breach ends on 10 July 2023, the date of the European Commission's adequacy decision on the EU-US Data Privacy Framework and the date of Microsoft's certification under it. The Chamber states that, for transfers such as those in this case and while the adequacy decision stands, a transfer impact assessment is no longer required. The Chamber also sets out what would follow if the Court of Justice annulled the adequacy decision: the two bodies would have to adopt an alternative transfer mechanism, such as the 2021 standard contractual clauses, and document their risk analysis.

The decision states expressly that the use of Microsoft Teams, and of related Microsoft applications, is not called into question in this case.

An appeal may be lodged within 30 days of notification with the Market Court, the Brussels court of appeal.

The decision was taken on 9 October 2026, before this issue's coverage period, and appeared on the APD's published decisions list during it. The decision itself states no publication date.

Why it matters

The breach is that the two bodies never assessed whether the clauses actually protected the data in the circumstances of these transfers, and so could not show that the risk had been mitigated. The duty to assess comes from Schrems II, and from 2021 it is written into Clause 14 of the standard contractual clauses themselves. The Chamber's route is that without the assessment the Article 46 tool was not shown to afford essentially equivalent protection, and on that basis it found the breach of Articles 44 and 46(2)(c). The decision also treats connection telemetry, down to an event name and an IP address, as personal data in the hands of a controller who can tie it to a named person.

Practical impact

For a controller transferring on standard contractual clauses to an importer that is not certified under the Data Privacy Framework: establish whether a documented transfer impact assessment exists for each transfer scenario, and whether it addresses the surveillance laws of the destination country rather than only the importer's contractual promises. Where one is missing for a transfer already running, carry it out now and record why it was late. For a controller relying on the Data Privacy Framework: ask the vendor whether its current certification covers the data in question, since a certification is scoped and renewed annually, and prepare the analysis that would be needed if the adequacy decision fell rather than starting from nothing. For anyone running interviews, assessments or meetings over a video platform: where the organiser can link the diagnostic and attendance data to a named participant, as the organising body could here, treat those data as personal data, not only the recording.

Sources
Primary sources APD APD, decision on the merits 278/2026 of 9 October 2026 (PDF, French)
Further context APD APD, published decisions
Copies a clean, cited sentence for use in a note.
3

Key Developments

AI Act EU Implementing decision 12 October 2026

The first harmonised standard under the AI Act is referenced in the Official Journal, and the European Commission says it gives high-risk providers presumed conformity on quality management

Commission Implementing Decision (EU) 2026/2274 of 12 October 2026 was published in the Official Journal on 14 October 2026 and entered into force the same day. It concerns the harmonised standards for high-risk AI systems drafted in support of Regulation (EU) 2024/1689.

The decision publishes the reference to a standard, not the standard itself. The standard is a CEN and CENELEC deliverable and comes from a national standards body, not from the Official Journal. It is EN 18286:2026, "Artificial intelligence - Quality management system for EU AI Act regulatory purposes". The decision's recitals record that it covers the quality management system a provider must maintain, including post-market monitoring processes.

The decision's recitals also restate the presumption of conformity in Article 40 of the AI Act: where the reference to a harmonised standard has been published in the Official Journal, a high-risk AI system that meets that standard, or parts of it, is presumed to satisfy the requirements the standard covers.

It is the European Commission, in its announcement of 19 October 2026, that ties that presumption specifically to the quality management system requirements in Article 17. The decision does not mention Article 17, and the reach of the presumption to that article is not self-evident from the Regulation: Article 40(1) states the presumption by reference to the requirements in Section 2 of Chapter III, Articles 8 to 15, while Article 17 sits in Section 3.

In the same announcement the Commission says the standard is designed to be layered on top of existing international standards such as ISO/IEC 42001, ISO 9001 or a sectoral quality management standard such as ISO 13485, and that further harmonised standards are expected.

A harmonised standard is voluntary: under Regulation (EU) No 1025/2012 a standard is a technical specification with which compliance is not compulsory. A provider may demonstrate conformity another way, but a provider that follows the standard is presumed to meet the requirements it covers, which shifts the burden in any later examination.

The requirements for high-risk AI systems are not yet applicable. Under Regulation (EU) 2026/1744, the Digital Omnibus on AI, they apply from 2 December 2027 for systems falling under Article 6(2) and Annex III of the AI Act, and from 2 August 2028 for those falling under Article 6(1) and Annex I, Section A.

Why it mattersThis is the first harmonised standard whose reference has been published under the AI Act, and on the European Commission's reading it carries a presumption of conformity on quality management, the governance layer the rest of the high-risk obligations sit on. It arrives more than a year before the requirements themselves apply, which is the point: a management system is not something an organisation adopts in the quarter before a deadline. How far the presumption actually reaches is worth watching, since the Commission's reading goes further than the article the Regulation uses to state it.
Practical impactFor a provider of high-risk AI systems: obtain the standard from a national standards body and map it against any management system already certified, which for an organisation already working to a recognised AI or quality management standard should mean a gap analysis rather than a fresh implementation. For an importer or deployer negotiating with a provider: ask whether the provider conforms to EN 18286:2026 and how it would evidence that, well before the obligations apply.
Sources
Primary sources EUR-Lex Implementing Decision (EU) 2026/2274 of 12 October 2026 (EUR-Lex) Commission European Commission, first harmonised standard supporting the AI Act published in the Official Journal, 19 October 2026
Further context EUR-Lex AI Act, Regulation (EU) 2024/1689, Article 40 (EUR-Lex) EUR-Lex Regulation (EU) 2026/1744, Digital Omnibus on AI (EUR-Lex)
Copies a clean, cited sentence for use in a note.
B2B prospecting France Guidance 16 October 2026

The CNIL sets out when an organisation may infer a professional email address from a name and an employer's address pattern

On 16 October 2026 the CNIL published two linked pages on what it calls the reconstitution of professional email addresses: deducing that a person's address is probably firstname.lastname at their employer's domain, by applying the pattern of addresses already known for that organisation.

The CNIL's starting point is that the practice is governed by the GDPR, and that the data being accessible online does not relieve the organisation of the applicable rules or, where they apply, of the rules on commercial prospecting.

On the legal basis, the CNIL says that where the inference serves a prospecting activity that itself rests on legitimate interests, the inference can generally rest on the same basis. It adds that this is neither automatic nor systematic, and that the balance must be examined case by case. It cites Article 6 GDPR. For public administrations and bodies with a public service mission, it says the inference may instead rest on the public interest basis in Article 6(1)(e), with the same safeguards applied.

The CNIL then sets out what it expects in practice. The organisation must have a real and legitimate interest in contacting the person. Whether the person can reasonably expect the inference is assessed against the purpose, how intrusive the practice is and how visible the data are. The absence of any professional presence online is, in its words, a strong indication that the person did not wish their details to be accessible, and a person who has protected or concealed their contact details cannot, as a rule, reasonably expect their address to be reconstituted. Where the conditions are not met, the CNIL says the organisation should abstain unless it can obtain the person's consent.

Among the conditions it sets, two are operational. An inferred address should be kept only if a first effective contact follows within a reasonable time. And where a person objects, without having to give reasons, they should be excluded immediately from any further reconstitution, not only from the processing that prompted the objection.

The two pages are guidance, not a sanction decision, and they do not establish a new obligation. They state how the CNIL reads existing ones.

Why it mattersInferring an address sits inside most sales intelligence and prospecting tools, usually as a feature nobody has assessed separately from the prospecting it feeds. The CNIL does not require a separate legal basis for it, but it does require the balance to be struck for the inference itself, which turns a background technique into something a controller has to be able to justify on its own terms.
Practical impactFor an organisation doing B2B prospecting: find out whether addresses are being inferred rather than collected, since the two are usually held in the same field. Record the real and legitimate interest in contacting the person, and the assessment of what that person could reasonably expect. Set a retention rule that deletes an inferred address where no effective contact followed; the CNIL names no period, so the period and the reasoning for it are the organisation's to document. Check that an objection propagates to the inference step and to every later use, not only to the mailing list it was received on. A legal basis for the inference does not by itself allow a prospecting email to be sent: the separate rules on electronic prospecting still decide whether consent is needed. This is the CNIL's reading of the GDPR rather than a French-only rule, so an authority elsewhere may be persuaded by it but is not bound by it.
Sources
Primary sources CNIL CNIL, reconstitution of professional email addresses, the framework, 16 October 2026 (French) CNIL CNIL, reconstitution of professional email addresses, your rights, 16 October 2026 (French)
Copies a clean, cited sentence for use in a note.
4

Enforcement Watch

Cookies and advertising France Closure of an injunction 23 September 2026, published 14 October 2026

The CNIL closes the Google injunction without liquidating the penalty, and records in the same decision that the quickest account creation path has become less intelligible

By deliberation SAN-2026-014 of 23 September 2026 the CNIL's restricted committee closed the injunction attached to its decision of 1 September 2025, which fined Google LLC 200 million euro and Google Ireland Limited 125 million euro, 325 million euro in all.

The injunction had two limbs. On the breach of Article 82 of the French Data Protection Act, the companies were required to give users in France sufficient information to understand that cookies pursuing an advertising purpose will necessarily be placed when a Google account is created. On the breach of Article L. 34-5 of the postal and electronic communications code, they were required to obtain the prior consent of users in France before any electronic prospecting on their Gmail account that takes the form of advertisements inserted between the emails. A periodic penalty of 100 000 euro per day of delay on each company was attached, running from six months after notification.

On the Gmail advertisements, the restricted committee records that on the web and mobile versions the advertisements are now pinned at the bottom of the Promotions and Social tabs of the inbox and are fixed, so that the emails can be scrolled without the advertisements moving. They are not the same colour as the emails and carry the word "Annonce" where an email shows the sender's name. They can be dismissed, by clicking an icon on the web version and by swiping on mobile, and once dismissed no further advertisement appears for the rest of the session.

On account creation, Google offers two routes, which the committee calls the one-step path and the four-step path. The committee notes that information about access to the service being conditional on the placing of cookies was added to both. At the step where the user chooses between them, the companies added: "Les annonces nous permettent de proposer la plupart de nos services gratuitement. Pour créer un compte Google, vous devez accepter l'utilisation de cookies et de technologies similaires, y compris à des fins publicitaires." Wording elsewhere was changed so that personalised and generic advertising are presented more even-handedly, and one step of the four-step path was given a more neutral title.

Given the scope of the injunction, the committee found that the companies had satisfied it within the time allowed, and the operative part states that the periodic penalty is not to be liquidated, that is, not fixed and ordered to be paid. The CNIL's announcement of the closure states that, with the advertisements in their new form, consent under Article L. 34-5 is no longer required for them.

The committee then went further than the closure required. It sets out that compliance with the injunction does not prejudge the conformity of the account creation paths as a whole, a question the CNIL frames under Article 82 of the French Data Protection Act, and which must also be assessed against the clarity of the information given and the intelligibility of the screens presented to the user one after another. On that, the committee describes three things.

The one-step path, as modified, now consists of four screens, where the version examined during the procedure had two. The committee says this makes the path meant to be the quickest more complex and less intelligible, with the relevant information scattered among other content. Some choices remain unclear, such as a "refuse all" option that covers three separate settings at once.

A user on the one-step path still cannot actively choose generic advertising, by ticking a box for instance; generic advertising can be arrived at only by refusing personalised advertising.

And the step headed "Accept cookies", which carries a substantial amount of information on what the cookies are for, appears late in both paths, at a point where the user will already have expressed a cookie choice, which the committee says harms the overall intelligibility of the paths.

The CNIL adds that it reserves the right to carry out further checks and, if necessary, to use its enforcement powers.

Why it mattersThe closure itself is the smaller half of this decision. A supervisory authority that has just accepted a remedy has used the same text to put on record that the path it examined has become harder to understand, not easier, and that adding screens and scattering information through a flow is a defect in its own right. The three observations are not findings and impose nothing, but they describe with unusual precision what the CNIL says it may check next, and they are the clearest statement it has given that the intelligibility of a consent flow is assessed across the sequence of screens rather than screen by screen.
Practical impactTest an existing flow against the three defects the CNIL names. Count the screens in the quickest path and compare with what was there before; check whether a user can choose the less intrusive option actively rather than only by refusing the other; and check whether the screen that explains what the cookies are for comes before or after the point at which the choice is made. For a publisher or platform serving advertising inside a messaging or inbox interface, the committee recorded four features: a fixed position outside the message list, a different colour, an explicit label where the sender's name would be, and the ability to dismiss. The deliberation does not state them as criteria, so they are what one authority accepted in one case rather than a specification.
Sources
Primary sources Légifrance deliberation SAN-2026-014 of 23 September 2026 (Légifrance, French) CNIL CNIL, closure of the injunction against Google, 14 October 2026 (French)
Further context CNIL CNIL, closure of the injunction against Google, 14 October 2026 (English)
Copies a clean, cited sentence for use in a note.
Security of processing Lithuania / Romania Investigation findings and fine 16 October 2026

Lithuania finds missing multi-factor authentication on access to national registers, and Romania fines a company for using real personal data in a test environment

Lithuania, the State Data Protection Inspectorate

On 16 October 2026 Lithuania's State Data Protection Inspectorate (VDAI) announced that it had concluded its investigations into unlawful access to national registers. Attackers gained unlawful access to the email accounts of two Migration Department employees and used those accounts to reach the Real Estate Register and the Register of Legal Entities. The VDAI says 678 976 Real Estate Register extracts, relating to 538 226 people, and 33 Register of Legal Entities extracts, relating to 66 people, were affected.

The VDAI made findings against three bodies. Against the Information Technology and Communications Department, which the VDAI found had not ensured adequate access control over the email system, it found no multi-factor authentication, no additional access controls and an inadequate assessment of the risk of account compromise, under Articles 5(1)(f) and 32(1)(b) GDPR. Against the Centre of Registers it found no multi-factor authentication, no IP address filtering, insufficient password controls and insufficient monitoring of user queries, together with late notification, under Articles 5(1)(f), 32(1)(b), 33(1) and 34(1). The Migration Department had not given the Centre of Registers the specific external IP addresses from which Migration Department staff would connect; the VDAI found a breach of Article 24(1) and issued a reprimand, while stating that this failure did not in itself make the unlawful access possible.

The VDAI has decided to open administrative fine proceedings against the Information Technology and Communications Department and the Centre of Registers. No amount has been set. The decision, numbered 3R-1815 (2.13-1.E), may be appealed to court.

Romania, the National Supervisory Authority

On 16 October 2026 Romania's National Supervisory Authority for Personal Data Processing (ANSPDCP) announced a fine of 31 451 RON, which the authority gives as the equivalent of 6 000 euro, on MYCONNECTOR PLATFORM SRL under Article 32(1)(b) and Article 32(2) GDPR. An attack on a test server exposed names, email addresses, telephone numbers, personal numerical codes and identity document series and numbers. The ANSPDCP found that the exposure resulted from the absence of technical and organisational measures appropriate to the risk, and that using real rather than fictitious personal data to test the application aggravated the impact of the incident.

Alongside the fine the ANSPDCP issued an order under Article 58(2)(d) requiring the company to adopt an internal procedure under which only fictitious data may be used in development and testing environments. The investigation began with the company's own breach notification under Article 33. The announcement does not state whether the decision is final.

Why it mattersNeither case turns on a novel point of law, and that is what makes them useful. Two authorities in the same week acted on controls that are routinely described as good practice: the VDAI found the absence of multi-factor authentication on accounts that reach a national register to be a breach of Article 32(1)(b), and the ANSPDCP ordered, under Article 58(2)(d), a procedure allowing only fictitious data in development and testing environments. The Lithuanian findings also show the shape of a supply chain failure inside government, where the weight fell on the department running the email system and on the register operator rather than on the body whose accounts were used.
Practical impactFor an operator of systems that expose bulk data through query interfaces: expect the same four controls the VDAI measured against to be the questions asked. The Lithuanian findings are at the stage of opened fine proceedings and may be appealed, so they are an indication of direction rather than settled precedent. For a development team: check whether production data reaches test, staging or demonstration environments, and if it does, write the prohibition into a procedure rather than leaving it to practice, which is what the Romanian order requires. Note that notifying a breach did not prevent a fine in the Romanian case.
Sources
Primary sources VDAI VDAI, conclusion of investigations into unlawful access to register data, 16 October 2026 (Lithuanian) ANSPDCP ANSPDCP, press release of 16 October 2026 (Romanian)
Further context VDAI VDAI, 2026 decisions register (Lithuanian)
Copies a clean, cited sentence for use in a note.

Each story links to its supporting sources. Editorial analysis is clearly marked separately from factual reporting.

Sources and references

How the brief is prepared and checked

This newsletter is prepared with the help of AI and goes through several stages of review. Please check the original source before relying on the information presented here.